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Why GAO Did This Study 

Countries posing national security 
concerns to the U.S. could upgrade 
their military forces with certain 
technologies having civilian and 
military (dual-use) applications. The 
Department of Commerce 
(Commerce) may require employers 
to obtain a "deemed export" license 
before they can transfer these 
technologies to foreign nationals in 
the U.S. The State Department also 
requires foreign nationals to obtain 
specialty occupation visas to work in 
the U.S. in occupations such as 
engineering, computers, and 
biotechnology. GAO was asked to 
examine the risk that foreign 
nationals in the U.S. may gain 
unauthorized access to controlled 
technologies, and the extent to which 
Commerce and other agencies 
implemented recommended changes 
to the deemed export licensing 
process and enforcement system. 
GAO analyzed licensing and visa data 
from Commerce and Homeland 
Security, respectively; reviewed 
reports; and met with law 
enforcement agencies, companies, 
and universities in Boston, Los 
Angeles, and San Francisco. 

What GAO Recommends 

Commerce should (1) assess issuance 
of specialty occupation visas covered 
by deemed export license 
applications and (2) report to 
Congress on how it will implement 
prior deemed export 
recommendations as part of the 
export control reform process. 
Commerce agreed with the first 
recommendation, but did not 
comment on reporting to Congress. 
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For more information, contact Joseph A. 
Christoff at (202) 512-8979 or 
christoffj@gao.gov. 



What GAO Found 

Four factors together may indicate the risk that foreign nationals could gain 
unauthorized access to controlled dual-use technology. First, according to 
unclassified intelligence reports and law enforcement officials, foreign 
businessmen, scientists, engineers, and others have gained unauthorized 
access in the United States to controlled dual-use technologies. Second, 
during fiscal years 2004 through 2009, Commerce suspended the export 
privileges of three violators and fined 14 U.S. companies about $2.3 million for 
allowing foreign nationals unauthorized access to controlled technologies. 
Third, Commerce's screening of overseas visa applications for potential 
unlicensed deemed exports dropped from 54,000 in fiscal year 2001 to 150 in 
fiscal year 2009. Fourth, from fiscal years 2004 to 2009, the United States 
issued about 1.05 million specialty occupation visas in high-technology fields 
to foreign nationals from 13 countries of concern to work in the United States, 
while Commerce issued deemed export licenses authorizing transfers of 
technology to about 3,200 foreign nationals from these countries. 

Commerce and Immigration and Customs Enforcement (ICE) have not 
implemented prior recommended changes to the deemed export licensing 
process involving outreach, and Commerce has taken action to clarify a 
regulatory definition, but confusion may remain. As a result, employers may 
not be aware of deemed export licensing requirements and obtaining the 
licenses required. GAO and other audit organizations made two key 
recommendations to correct weaknesses in the deemed export licensing 
process. The first recommended that Commerce develop an approach or plan 
to better inform employers about requirements to apply for deemed export 
licenses. However, Commerce still lacks an approach or plan to provide such 
information, particularly to small and mid-size companies. The second 
recommended that Commerce eliminate confusion by modifying the 
regulatory definition that is part of determining when foreign nationals can 
access controlled technologies in fundamental research without triggering the 
deemed export licensing requirement. In response, Commerce clarified the 
definition but may not have eliminated the confusion, as shown by uncertainty 
within Commerce over the definition, which resulted in a misunderstanding 
with a U.S. agency. Based on guidance from Commerce, the agency applied 
for 37 deemed export licenses, which Commerce processed over a 17-month 
period before advising the agency that it no longer needed to apply for such 
licenses. 

Commerce has not implemented GAO's and others' recommendations to the 
export enforcement system involving monitoring license compliance and 
using immigration data for deemed export enforcement. Commerce has not 
created a program to monitor security conditions in licenses or used existing 
immigration data to enforce deemed export regulations. Commerce, ICE, and 
the Federal Bureau of Investigation have also not implemented 
recommendations to improve coordination on export control investigations, 
including those of foreign nationals subject to deemed export controls. 
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The Honorable Michael C. Burgess 
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Countries posing national security concerns to the United States could 
upgrade their military forces with controlled dual-use U.S. technologies — 
technologies that have both civilian and military uses. To protect its 
national security and foreign policy interests, the United States controls 
the export of dual-use technologies having both civilian and military uses 
to certain countries of concern. 1 For this purpose, the Department of 
Commerce (Commerce) may require exporters of these goods to obtain an 
export license; similarly, Commerce regulations also deem certain 
transfers of controlled technology or source code to foreign nationals in 
the United States to be exports, requiring companies, universities, and 
agencies in some instances to obtain a "deemed export" license before 



'For the purposes of this report, we selected 13 countries of concern. We based this 
selection on several criteria, including (1) Commerce regulations that group countries by 
their level of restrictions and concern; (2) unclassified intelligence reports and discussions 
with U.S. law enforcement officials; (3) the ranking of countries by the number of deemed 
export enforcement cases from fiscal years 2002 through 2009; and (4) the publicly 
reported associations of some countries' citizens with export enforcement cases over the 
past several years. Appendix I more fully explains how we selected these countries. The 
names of the countries of concern, while provided in a classified report, are omitted here. 
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they can transfer these technologies to foreign nationals. 2 According to the 
2007 report of the Deemed Export Advisory Committee (DEAC), which 
was formed to review deemed export policy, deemed export controls can 
significantly strengthen national security by preventing foreign 
governments or terrorists from acquiring cutting-edge civilian technologies 
for military use. However, deemed export controls can have an adverse 
effect on U.S. industry and academia by imposing added costs not faced by 
overseas competitors. 3 The executive branch is currently considering 
reforms to the U.S. export control regime in an Export Control Reform 
Initiative that would also affect deemed export licensing and enforcement. 
For instance, in August 2009 the President created an interagency task 
force to examine proposed export control reforms, and in November 2010, 
signed an executive order establishing an Export Enforcement 
Coordination Center to coordinate and strengthen the U.S. government's 
export enforcement efforts, including for deemed exports. 4 

In prior reports, we identified numerous weaknesses in the deemed export 
control system that could allow the unauthorized transfer of controlled 
technologies to foreign nationals in the United States. We also made 
several recommendations designed to prevent the unauthorized transfer of 
such technologies. For instance, in 2002, we reported that Commerce did 
not have a program to monitor compliance with the license security 
conditions imposed on almost all of the deemed export licenses 
approved. 5 We recommended that Commerce work with the Departments 
of Defense (DOD), State, and Energy to develop a risk-based program to 



2 The Export Administration Regulations (EAR), 15 C.F.R. § 730-774, define technology as 
specific information necessary for the "development," "production," or "use" of a product. 
15 C.F.R. § 772.1. The technologies controlled for export are generally contained in the 
Commerce Control List (CCL), Supplement 1 to Part 774,and fall into 10 categories 
including computers, chemical and biological substances, electronics, and materials 
processing. An example of a technology that is controlled and on the CCL involves certain 
fermenters used for growing bacteria and fungi in laboratories. These can be used in the 
development of vaccines and medical treatments but are controlled because they can also 
be used to create dangerous toxins for biological warfare. 

3 According to the DEAC, the United States is the only nation that implements a deemed 
export control system and participates in multilateral export control regimes. Other 
nations depend largely on their visa processes, intelligence information, and commercial 
intellectual property controls rather than a formal deemed export licensing system. 

"Executive Order 13558, 75 Fed. Reg. 69,573 (Nov. 9, 2010). 

5 See for instance GAO, Export Controls: Department of Commerce Controls over 
Transfers of Technology to Foreign Nationals Need Improvement, GAO-02-972 
(Washington, D.C.: Sept. 6, 2002). 
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monitor compliance with deemed export licensing security conditions. We 
also found that Commerce did not screen thousands of immigration 
applications from foreign nationals in the United States who may seek 
work in U.S. high-technology industries. We recommended that Commerce 
use all existing U.S. immigration data to identify foreign nationals who 
could be subject to deemed export licensing requirements. Since our 2002 
report, the Commerce and the Department of Homeland Security (DHS) 
Inspector Generals (IG), GAO, and other auditing organizations have 
issued several additional reports that discuss in full or in part the deemed 
export control system. 6 

In response to your request, we have updated our 2002 report on deemed 
exports, examining (1) the risk that foreign nationals in the United States 
may gain unauthorized access to controlled dual-use technologies, (2) the 
extent to which Commerce and other agencies have implemented 
recommended changes to the deemed export licensing process, and (3) 
the extent to which Commerce and other agencies have implemented 
recommended changes to the deemed export enforcement system. 

To address these objectives, we examined applicable laws and directives 
and obtained fiscal year 2004-2009 data from Commerce's export licensing 
database system. We also obtained fiscal year 2004-2009 data from a DHS 
database that documents specialty occupation visa trends. 7 We chose 
these time frames due to concerns about the reliability of data produced 
before fiscal year 2004. Based on GAO's and others' reports and interviews 
with agency officials, we determined that the data were sufficiently 
reliable for our use. For the purposes of this report, we selected four 
broad "specialty occupation" employee fields: engineering, computers, the 
physical sciences, and the life sciences, which generally correspond to 
employees working with technologies on the Commerce Control List 
(CCL). We chose these fields and not others such as the social sciences 



GAO, Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance 
for Protecting Export-Controlled Information at Companies, GAO-07-69 (Washington, 
D.C.: Dec. 5, 2006); Export Controls: Agencies Should Assess Vulnerabilities and Improve 
Guidance for Protecting Export-Controlled Information at Universities, GAO-07-70 
(Washington, D.C.: Dec. 5, 2006); and Export Controls: Challenges Exist in Enforcement of 
an Inherently Complex System, GAO-07-265 (Washington, D.C.: Dec. 20, 2006). 

A U.S. employer may temporarily hire a foreign national in a specialty occupation or as a 
fashion model of distinguished merit and ability by applying for an H-1B specialty 
occupation visa, which in general requires the theoretical and practical application of a 
body of specialized knowledge. This includes a bachelor's degree or the equivalent in fields 
such as the sciences, medicine and health care, education, or biotechnology. 
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because they include some of the most technologically advanced 
occupational fields such as aeronautical engineering. We also based our 
decision to include these fields on unclassified intelligence and law 
enforcement reports, as well as deemed export data. We quantified the 
number of foreign nationals approved for specialty occupation visas from 
13 countries of concern using DHS immigration data. We reviewed 
Commerce, DHS, and interagency IG reports, and other reports. In 
Washington, D.C., we met with officials of the agencies responsible for 
reviewing license applications — the departments of Commerce, Defense, 
State, and Energy — as well as the agencies that outreach to companies, 
universities, and agencies and enforce deemed export licensing conditions 
and regulations — Commerce, DHS (the U.S. Immigration and Customs 
Enforcement (ICE)), and the Department of Justice (principally the 
Federal Bureau of Investigation (FBI)). We also met with officials of DHS's 
U.S. Citizenship and Immigration Service (USCIS) to discuss a change to 
their Form 1-129 that would require employers to acknowledge deemed 
export licensing requirements. In addition, we met with officials of law 
enforcement agencies in Washington, D.C.; Boston; Los Angeles; and San 
Francisco, as well as representatives of 33 associations, companies, 
universities, nonprofits, and agencies in these cities. We selected the 
nonprobability sample based in part on an analysis of Commerce's fourth 
quarter fiscal year 2007 and fiscal year 2008 deemed export outreach plan. 

We conducted this performance audit from July 2009 to February 2011 in 
accordance with generally accepted government auditing standards. These 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. Appendix I provides a more detailed 
description of our objectives, scope, and methodology. This report is an 
unclassified version of a December 2010 classified report. 



RGSllltS in Brief Four factors — intelligence and law enforcement sources; fines and 

suspensions for deemed export violations; a reduced number of overseas 
visa applications that Commerce screens; and a large number of foreign 
nationals in the United States with specialty occupation visas in high- 
technology fields that may have required an export license — together may 
indicate the continuing risk that foreign nationals could gain unauthorized 
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access to controlled technology. 8 First, foreign businessmen, scientists, 
engineers, and academics from countries of concern have gained 
unauthorized access to controlled dual-use technologies in the United 
States, according to intelligence and law enforcement sources. Second, 
from fiscal years 2004 to 2009, Commerce fined 14 U.S. companies about 
$2.3 million for making unauthorized transfers of controlled technologies 
to foreign nationals from 25 countries. Commerce also suspended the 
export privileges of one company and two individuals for 20 years each. 
The majority of the enforcement actions involved foreign nationals from 
three countries. Third, Commerce officials stated that they screened 150 
visa applications from U.S. posts overseas in fiscal year 2009 to identify 
potential unlicensed deemed exports — fewer than the 54,000 visa 
applications screened in fiscal year 2001 — because of a change in 
procedures that is more reactive, focusing on leads and intelligence 
information, rather than proactive screening. Finally, we found that while 
USCIS approved a large number of foreign nationals for specialty 
occupation visas from 2004 to 2009, Commerce issued deemed export 
licenses authorizing the transfer of technology to a smaller number of 
foreign nationals during the same period. The U.S. government addressed 
shortages of U.S.-born engineers and scientists by approving specialty 
occupation visas in occupational fields including engineering, computers, 
electronics, and the biological sciences to approximately 1.05 million 
foreign nationals from 13 countries of concern. From fiscal years 2004 to 
2009, Commerce issued deemed export licenses authorizing the release of 
technology to 3,178 foreign nationals from the same 13 countries. 
However, not all foreign nationals with H-1B specialty occupation visas 
are required to apply for deemed export licenses. 



To estimate the risk that foreign nationals working in high-technology fields could gain 
access to controlled technology, we selected four broad specialty occupations based on an 
examination of the categories of technology contained in the CCL and a review of 
unclassified reports detailing the types of dual-use technologies that countries are 
attempting to obtain. The four broad specialty occupation fields were computers, 
engineering, the physical sciences, and the biological sciences, including biotechnology. 
We excluded other H-1B occupational fields such as those in the social sciences. We then 
quantified the number of foreign nationals from 13 countries of concern working in these 
specialty occupation fields. We selected these 13 countries based on our analysis of the 
Export Administration Regulations, which groups countries by their level of restrictions, as 
well as intelligence reports, discussions with law enforcement officials, and the publicly 
reported associations of some countries' citizens with export enforcement cases over the 
past several years. Appendix I more fully details our methodology. We identified the names 
of these countries in our classified report. 
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Commerce and ICE have not implemented recommended changes to the 
deemed export licensing process involving outreach, and Commerce has 
taken action to clarify a regulatory definition, but confusion may remain. 
As a result, employers may be obtaining deemed export licenses for 
transfer of technology to fewer foreign nationals than should be the case. 
GAO and other audit organizations previously made two key 
recommendations to correct weaknesses in the deemed export licensing 
process. 9 The first recommendation focused on providing better outreach, 
such as Commerce developing an approach or outreach plan to inform 
companies, universities, and agencies that employ foreign nationals of 
deemed export control requirements so they would apply for deemed 
export licenses when required. While Commerce has incorporated 
information on deemed export requirements in its training materials, it 
continues to lack an approach or outreach plan to provide information on 
deemed export licensing requirements, particularly to small- and mid-size 
companies, many of which employ foreign nationals but may not be 
familiar with the requirements. Such an outreach plan would have annual 
goals and identify priority industries, U.S. agencies, and academic 
institutions that are not currently applying for export licenses for the 
release of controlled technology to foreign nationals in the United States. 
According to Commerce and company representatives, such outreach 
would be particularly useful to the growing biotechnology sector. The 
second recommendation advised Commerce to modify the regulatory 
definition of "use" set forth in the Export Administration Regulations 
(EAR), which determines when technology to use controlled commodities 
can be released without triggering a deemed export licensing requirement. 
After reviewing the issue, including public comments on the 
recommendation, Commerce has not modified this definition, but has 
taken actions to clarify it. However, as shown by uncertainty within 
Commerce over the definition of "use" technology that resulted in a 
misunderstanding with the National Institutes of Health (NIH), 
Commerce's clarification may not have eliminated the confusion. Based on 
guidance from Commerce on the definition, NIH applied for 37 deemed 
export licenses, which Commerce processed over a 17-month period 
before advising NIH that it no longer needed to apply for such licenses, 
though the definition itself remained the same. 

Commerce has not implemented recommendations that we and others 
made involving monitoring compliance with deemed export licensing 



The other audit organizations were the Commerce IG and the DHS IG. 
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conditions and using immigration data to improve deemed export 
enforcement, while Commerce, ICE, and FBI have not implemented 
recommendations to improve coordination, as described below: 

• Commerce continues to lack a compliance program to monitor security 
conditions on deemed export licenses, even though our 2002 and the 
Commerce IG's 2004 reports recommended that it establish one. 10 A 
compliance program should involve on-site inspections of facilities to 
determine whether the license holder is complying with specific license 
conditions. In particular, all potential points of access to the controlled 
technology should be reviewed for appropriate safeguards, and a 
technology control plan to prevent foreign nationals from accessing 
controlled technologies should be implemented to ensure compliance with 
license conditions, according to the Commerce IG. The security conditions 
are imposed to help prevent foreign nationals from obtaining unlicensed 
access to controlled technologies and are attached to almost all of the 
deemed export licenses approved. In fiscal year 2006, Commerce 
established a program to monitor licensing conditions, but discontinued it 
after fiscal year 2007, citing competing priorities and budget constraints. 

• Commerce does not use all existing DHS immigration data to detect firms 
that should have applied for deemed export licenses. In 2002, we 
recommended that Commerce use all existing immigration data, including 
data from change-of-status applications, to identify foreign nationals who 
could be subject to deemed export licensing regulations. In response to 
our recommendation, Commerce and DHS have begun discussing how to 
share these data, but have not finalized arrangements. DHS announced 
proposed changes to its primary immigration form in February 2010 that 
would make it easier for Commerce, ICE, and FBI to use immigration data 
for deemed export enforcement. 

• Commerce, ICE, and FBI have not resolved weaknesses in the 
coordination of their overall export enforcement activities, 
notwithstanding our recommendations in 2006, which could impact 



10 GAO-02-972; U.S. Department of Commerce/Office of Inspector General, Deemed Export 
Controls May Not Stop the Transfer of Sensitive Technology to Foreign Nationals in the 
U.S., Final Inspection Report No. IPE-16176 (Washington, D.C.: Mar. 31, 2004); Offices of 
the Inspectors General of the Departments of Commerce, Defense, Energy, Homeland 
Security and State, and the Central Intelligence Agency, Interagency Review of Foreign 
National Access to Export-Controlled Technology in the United States, Report No. D-2004- 
062 (Washington, D.C., Apr. 16, 2004). 
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deemed export enforcement. 11 For example, Commerce, ICE, and FBI 
have not created new written agreements or updated existing ones 
between and among these agencies to assign clear roles and 
responsibilities among the agencies as we recommended. According to 
Commerce, ICE, and FBI officials, the lack of such agreements has in 
some cases led to a duplication of efforts and ineffective sharing of 
investigative information, although they cited no specific cases involving 
deemed exports. 

To better direct its efforts to detect possible unauthorized deemed exports 
and conduct outreach, we are recommending that the Secretary of 
Commerce, in consultation with the U.S. Attorney General and the 
Secretary of Homeland Security, assess the extent to which foreign 
nationals from countries of concern who were issued specialty occupation 
visas also should have been covered by deemed export licenses and use 
the results to identify vulnerabilities in the deemed export control system, 
target and inform employers about deemed export licensing requirements, 
and incorporate immigration data into its enforcement screening activities. 
In addition, to ensure that Commerce more fully addresses the 
deficiencies identified in this and prior reports, as part of the export 
control reform process, we are recommending that the Secretary of 
Commerce report to Congress on the steps being taken to implement past 
GAO and Commerce IG recommendations. 

Commerce agreed with our first recommendation and stated that it would 
review prior GAO and IG recommendations as part of the ongoing Export 
Control Reform process. However, Commerce did not specifically agree or 
disagree with our recommendation to report to the Congress on the steps 
being taken to implement past GAO and Commerce IG recommendations. 
We believe this recommendation remains valid because resolving the 
deficiencies identified repeatedly since 2002 could be critical to the 
success of any export control initiative. Responding for the Attorney 
General, the FBI stated that it has conducted deemed export outreach to 
small-to-medium size biotechnology companies through several venues, 
including strategic task forces, counterintelligence working groups, 
conferences and other initiatives in coordination with the U.S. intelligence 
community and federal law enforcement agencies, including ICE and 
Commerce. FBI also stated that through participation at the National 
Export Enforcement Coordination Network (NEECN) and other arenas, 



GAO-07-265. 
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FBI, ICE, and Commerce have worked to resolve coordination of export 
enforcement activities. In our report we discuss the role of the NEECN, 
which ICE established to coordinate export control investigations, but 
note that ICE officials told us that the NEECN primarily focuses on 
investigations involving exports of goods, rather than deemed exports. 
Commerce's and FBI's written comments are contained in appendices V 
and VI. Commerce, FBI, and DHS also provided technical comments, 
which we have incorporated as appropriate. 



BcLCkSrOlind Under the Export Administration Act of 1979, as amended, 12 and the 

° implementing EAR, 13 companies, universities, and agencies may be 

required to obtain an export license before releasing controlled dual-use 
technology or source code subject to the EAR 14 to a foreign national who 
is not a permanent resident of the United States or a member of certain 
groups of protected individuals such as asylum holders. 15 Pursuant to the 
EAR, a transfer of technology within the United States to such a foreign 
national is deemed to be an export to his or her home country. 16 To 
determine whether a license is required, the employer or university 
researcher needs to (1) determine whether technologies under 
consideration for release to certain foreign nationals are on the CCL, (2) 
determine whether a license is required to export the technology to the 
home country of the foreign national, and (3) determine whether any 
license exceptions apply. 17 If it is determined that a licensing requirement 
applies, the employer must obtain a deemed export license before 



lz 50 U.S.C. App. §§ 2401-2420. The Export Administration Act of 1979, as amended (EAA) is 
not permanent legislation. Since August 21, 2001, the EAA has been in lapse. However, the 
President has continued the regulations in effect through Executive Order 13222 of 
August 17, 2001 (3 C.F.R., 2001 Comp 783 (2002)), which most recently was extended by 
Presidential Notice on August 12, 2010, under the authority provided by the International 
Emergency Economic Powers Act (50 U.S.C. §§1701 et seq.). See 75 Fed. Reg. 50,681 
(Aug. 12, 2010). 

13 15 C.F.R. parts 730-780. 

14 For purposes of deemed export rules, technology and source code that are on the CCL are 
of particular significance. According to Commerce, with a few exceptions, only controlled 
technology and source code listed on the CCL are subject to deemed export licensing 
requirements. 

15 15 C.F.R. § 734.2(b)(2)(ii). 

16 15 C.F.R. § 734.2(b)(2)(ii). 

17 15 C.F.R. § 738.4. 



Page 9 



GAO-11-354 Export Controls 



releasing controlled technologies to foreign nationals. 18 "Release" may 
include opportunities to review written materials or discussions about 
controlled technologies. Violators may face administrative or criminal 
penalties, including fines, denial of export privileges, and imprisonment. 19 
The EAR generally does not cover information that arises during, or 
results from, fundamental research. 20 As a result, information that falls 
within the scope of the EAR's "fundamental research" provision does not 
require a license for release to a foreign national. However, authorization 
may be required if technology that is controlled (typically, on the CCL) is 
transferred to a foreign national during the course of undertaking 
fundamental research. 21 

Commerce reviews and issues export and deemed export licenses, in 
consultation with other agencies, and enforces the EAR. Within 
Commerce's Bureau of Industry and Security, Export Administration 
reviews license applications, issues licenses, and provides information or 
outreach to companies, universities, and agencies that employ foreign 
nationals about deemed export licensing requirements principally through 
its own seminars and conferences, as well as seminars and conferences 
sponsored by other organizations. 22 Commerce intends for such 
information to inform and help exporters comply with export control 
requirements. Commerce's Office of Export Enforcement also provides 
outreach about deemed export licensing rules and regulations as part of its 
investigative efforts, often in meetings with representatives of companies, 
universities, agencies, and relevant associations. 

To work in the United States, foreign nationals and their employers must 
also comply with U.S. visa regulations for nonimmigrants wanting to work 
and study in the United States. Many foreign nationals who are not 
permanent residents in the United States that seek work here apply for H- 



18 15 C.F.R. § 736.2. 
19 15 C.F.R. § 764.3. 

20 The EAR describes this information as technology and software. In addition, certain 
software is subject to the EAR. 15 C.F.R. § 734.3(b)(3). 

21 Revisions and Clarification of Deemed Export Related Regulatory Requirements, 71 Fed. 
Reg. 30,840 (May 31, 2006). 

22 In addition, Commerce's Export Administration conducts outreach through phone 
conversations, e-mails, Internet-based training modules, and Webinars. A Webinar is a 
workshop or conference delivered over the Internet. 
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IB specialty occupation visas. An H-1B visa allows a U.S. employer to 
temporarily fill specialty occupations (such as those requiring electrical or 
software engineers) with foreign workers. A foreign national overseas may 
obtain an H-1B visa from State, if USCIS determines that an employer may 
employ the foreign national as a temporary worker. USCIS is the agency 
within DHS that oversees lawful immigration to the United States. A 
foreign national already in the United States may also have his or her 
immigration status changed to H-1B by USCIS. For example, an employer 
seeking to hire a foreign student who has graduated from a U.S. college or 
university could petition USCIS to change the foreign national's 
immigration status from student to H-1B. 

Executive Order 12981, 23 as amended, governs the interagency licensing 
review process for all dual-use exports. Pursuant to this order, other 
agencies provide recommendations to Commerce in the review of all 
export license applications, including deemed export license applications, 
as follows: 

• State's Bureau of International Security and Nonproliferation reviews the 
deemed export license applications that Commerce refers to it for 
proliferation concerns and makes recommendations on whether these 
licenses should be approved, approved with conditions, or denied. In 
addition, State's Bureau of Consular Affairs shares with Commerce and 
DOD certain information obtained from some foreign nationals during the 
visa application process. 24 

• DOD, principally the Defense Technology Security Administration (DTSA), 
reviews and evaluates deemed export licenses for technical, policy, and 
intelligence concerns, referring some licenses to the Army, Navy, and Air 
Force for additional study. In addition, DTSA refers some deemed export 
licenses to the Defense Intelligence Agency for information on foreign 
nationals from certain countries. 

• The Department of Energy reviews deemed export license applications 
that Commerce refers to it involving nuclear uses and nuclear end users, 
as well as other technologies, and makes recommendations on whether 
these license applications should be approved, approved with conditions, 



'60 Fed. Reg. 62,981 (Dec. 5, 1995). 

'Separately, State also licenses the export of weapons and military technology. 
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or denied. Energy principally relies on its network of 20 national 
laboratories to conduct its review. 

• FBI conducts checks of its records on behalf of Commerce when 
requested. 

In addition, two agencies assist with deemed export enforcement, which 
includes providing investigations-related outreach: 

• ICE enforces deemed export licensing regulations by conducting criminal 
investigations, indicting and prosecuting potential violators, and referring 
noncriminal violators to Commerce. In addition, since fiscal year 2001, ICE 
has provided outreach to companies, universities, and agencies that hire 
foreign nationals as part of a program known as Project Shield America. 25 
The focus of this program is to prevent the (1) proliferation of controlled 
technology and components; (2) unlawful acquisition of nuclear, chemical, 
and biological weapons; and (3) unlawful exportation of weapon systems 
and classified or controlled technical data. ICE's outreach efforts involve 
face-to-face discussions with representatives of companies, universities, 
and agencies, as well as discussions at seminars and conferences. 

• FBI enforces deemed export license regulations by conducting criminal 
investigations, indicting and prosecuting potential violators, and referring 
noncriminal violators to Commerce. FBI takes the lead in investigations 
involving counterintelligence and counterterrorism. In addition, FBI 
provides outreach through its Counterintelligence Strategic Partnership 
Program. The program entails the use of focus groups and meetings with 
leading universities and companies to raise awareness of threats and 
vulnerabilities involving controlled technologies to industry and academia. 
FBI's outreach efforts, like ICE's, involve face-to-face meetings as well as 
discussions at seminars and conferences. 

The review process for a deemed export license parallels the review 
process for an application for a license to export commodities or 



°Project Shield America assists in the prevention of export violations. Under the program, 
special agents cultivate relationships with and obtain the cooperation of U.S. companies, 
universities, and research facilities involved in the manufacture, sale, or export of U.S. 
strategic technology and munitions that could harm the country if illegally exported to 
countries or entities of concern. ICE began Project Shield America in fiscal year 2001, but 
according to ICE officials, an outreach program also existed before fiscal year 2001. 
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technologies overseas. 26 Under the EAR's deemed export provisions, an 
employer or university researcher is required to seek a deemed export 
license if the export of the technology to the foreign national's country of 
citizenship would require a license. If a license is required, the exporter 
(e.g., company, university, or agency) must submit a license application to 
Commerce identifying the technology, end use, and Export Control 
Classification Number; the proposed destination; and the intended end 
user. 27 In the case of deemed export license applications, employers or 
university researchers must also provide the foreign national's resume, 
visa type, and a list of his or her publications. An application for a deemed 
export license may list more than one individual, and an organization may 
also apply for more than one deemed export license for an individual, 
depending on the technologies that the employer or researcher wants to 
provide to the foreign national. 



Foreign Nationals 
from Countries of 
Concern Have Gained 
Unauthorized Access 
to Controlled 
Technologies in the 
United States 



Four factors — intelligence and law enforcement findings; fines and 
suspensions for deemed export violations; a reduced number of overseas 
visa applications that Commerce screens; and a large number of foreign 
nationals with specialty occupation visas in high-technology fields — 
together may indicate the continuing risk that foreign nationals could gain 
unauthorized access to controlled technology. First, countries of concern 
use their foreign nationals in the United States to acquire controlled dual- 
use technologies for military purposes, according to intelligence and law 
enforcement sources. Second, during fiscal years 2004 through 2009, 
Commerce fined 14 U.S. companies about $2.3 million for the 
unauthorized transfer of controlled technologies to foreign nationals from 
25 countries, and applied criminal penalties to one company and two 
individuals. It also suspended the export privileges of some exporters. 
Third, Commerce officials stated that they screened 150 visa applications 
from U.S. posts overseas in fiscal year 2009 to identify potential unlicensed 
deemed exports — fewer than the 54,000 visa applications screened in 



The time it takes to process an export control license can vary. Under Executive Order 
12981, license application determinations are supposed to be resolved or referred to the 
President within 90 days of the Bureau of Industry and Security having registered the 
completed license application. However, Executive Order 12981 also provides that 
agencies can "stop the clock" for various reasons, including to request additional 
information. 60 Fed. Reg. 62,981 (Dec. 5, 1995). 

27 See 15 C.F.R. part 748. The Export Control Classification Number (ECCN) is an 
alphanumeric code, e.g., 3A001, that describes a particular item or type of item, and shows 
the controls placed on it. All ECCNs are on the CCL. 
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fiscal year 2001 — because of a change in procedures. Finally, we found 
that while USCIS approved specialty occupation visas for a large number 
of foreign nationals from 2004 to 2009, Commerce approved deemed 
export licenses to cover a smaller number of foreign nationals during the 
same time period. 



According to intelligence reports and law enforcement sources, as well as 
congressional testimony and law enforcement officials, a small group of 
countries is responsible for most of the efforts to acquire controlled 
technologies for military purposes. The countries included in this small 
group are detailed in the December 2010 classified version of this report. 
According to congressional testimony presented in September 2005 by the 
Director of the Office of the National Counterintelligence Executive 
(ONCIX), 28 and intelligence assessments, some countries use some of their 
foreign nationals as part of organized programs to obtain controlled 
technologies while working, studying in, or visiting the United States. 29 In 
addition, the Director of ONCIX also testified that the U.S. government has 
limited insight into foreign intelligence operations in the United States. 
The Director of ONCIX also said that much of the intelligence collection 
against the U.S. technology base is carried out by those who are employing 
nontraditional collection means against the United States, rather than by 
known intelligence officers. As a result, the U.S. government has little 
knowledge of when individuals who ostensibly come to the United States 
for legitimate business purposes might have illegitimate objectives, 
according to this official. 30 

According to the ONCIX and other assessments, the technologies most 
often targeted for theft since 2002 have included aeronautics, computers 
and information systems, electronics, lasers and optics, sensors and 



The ONCIX is part of the Office of the Director of National Intelligence and is staffed by 
senior counterintelligence and other specialists from across the national intelligence and 
security communities. Among other things, the ONCIX develops, coordinates, and 
produces annual foreign intelligence threat assessments. 

^Sources and Methods of Foreign Nationals Engaged in Economic and Military 
Espionage: Hearing before the Subcommittee on Immigration, Border Security and 
Claims, of the Committee on the Judiciary, House of Representatives, 109th Cong. (2005). 

30 Commerce officials noted that emerging technologies are examined as part of an 
interagency process that involves preparing proposals to the four multilateral export 
control regimes and subsequently revising the CCL to add and delete technologies as 
appropriate, based on national security and other concerns. 



According to Reports and 
Officials, Countries of 
Concern Use Some of 
Their Citizens in the 
United States to Collect 
Controlled Dual-Use 
Technologies 
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marine technology, and unmanned aerial vehicles. In addition, according 
to ONCIX's 2003 Annual Report, biotechnology has been of particular 
interest. 31 Moreover, the ONCIX has expressed concern about emerging 
military technologies or commercial breakthrough technologies that have 
not yet been added to the CCL because these technologies are often hard 
to identify in their early phases and are more vulnerable to loss or 
compromise. 

Although the types of technologies involving deemed export licenses have 
changed little over the past 5 years, some industry sectors have grown and 
hired increasing numbers of foreign nationals. For example, the 
biotechnology industry — one area that the ONCIX identified as most often 
targeted by theft — has enjoyed rapid growth in both revenues and 
employment over the past few years. Although the economic downturn 
from 2008 to the present has generally resulted in lower levels of hiring 
and investment by U.S. industry, the biotechnology sector had previously 
grown at a rapid pace. According to a private sector study, the 
biotechnology industry's sales and revenues increased at least 80 percent 
from 2002 to 2006. 32 The number of employees involved in biotechnology 
research and development in the United States also doubled, from 
approximately 75,000 in 2003 to approximately 150,000 in 2006, according 
to the Organization of Economic Co-Operation and Development. 33 The 
Department of Labor's 2010-2011 edition of the Occupational Outlook 
Handbook forecast that the sector will continue to experience above- 
average employment growth rates of about 21 percent over the 2008-2018 
period. 34 

Countries targeting U.S. dual-use technologies have the opportunity to 
send their foreign nationals to work in the United States because the 
United States has shortages of qualified workers. Sixty-five percent of U.S. 
manufacturers report experiencing shortages of qualified employees, 
particularly of engineers and scientists, according to the 2007 report of the 



Annual Report to Congress on Foreign Economic Collection and Industrial 
Espionage — 2003, Office of the National Counterintelligence Executive, February 2004. 

32 Guide to Biotechnology 2008; Biotechnology Industry Association, Washington, D.C. 

33 van Beuzekom, Brigitte and Arundel, Anthony; OECD Biotechnology Statistics 2006 & 
OECD Biotechnology Statistics 2009, Organization for Economic Co-operation and 
Development, Paris. 

M Occupational Outlook Handbook, U.S. Bureau of Labor Statistics, Washington, D.C. 
(January 2010). 



Page 15 



GAO-11-354 Export Controls 



DEAC. About 18 percent of U.S. manufacturers report serious shortages 
and 47 percent report moderate shortages. 35 As the DEAC reported in 
2007, many of these positions could be filled by foreign nationals with H- 
1B specialty occupation visas. 



Penalties on Companies 
Show That Some Foreign 
Nationals from Countries 
of Concern Gained 
Unauthorized Access to 
Controlled Technologies 



Information obtained from analysis of Commerce investigations closed 
during fiscal years 2004 through 2009 provides evidence that some foreign 
nationals have gained unauthorized access to controlled dual-use 
technologies. These foreign nationals were predominantly from three 
countries of concern. Of the 16 dual-use deemed export enforcement 
investigations resulting in penalties, such as fines or suspension of trading 
privileges, 9 involved nationals of one country, as did all 3 investigations 
that concerned criminal violations of law involving the unauthorized 
release of technology. For example, Commerce levied fines of $517,000 
and suspended the export privileges of one company and two individuals 
for 20 years each in criminal cases for releasing CCL technology to 
nationals of one country without a license. Commerce also levied the 
largest fine for a deemed export case — $560,000 — against another 
company for releasing technical data to a national from the same country 
without authorization. 



Commerce No Longer 
Screens Many Overseas 
Visa Applications 



We reported in 2002 that Commerce screened visa applications submitted 
overseas; however, Commerce officials stated that they now screen few 
overseas visa applications. 36 In fiscal year 2001, Commerce screened about 
54,000 visa applications submitted to overseas posts, referring about 160 
potential cases to Commerce's field offices for further limited follow up 
and review. Pursuant to Commerce guidance in 2001, agency analysts 
screened State visas by using Commerce's enforcement database, DOD 
comments on rejected license applications, and other sources of 
information to detect linkages between foreign entities of concern and 
visa applicants. By contrast, in fiscal year 2009, Commerce screened only 
150 visa applications submitted overseas, referring just 1 to a Commerce 
field office for further review. Commerce officials stated that the agency 



°More recent data suggest that employers continue to rely heavily on foreign nationals to 
fill specialty positions, including high-technology positions. For instance, according to 
USCIS, in fiscal year 2009, approximately 214,000 H-1B visas were approved for foreign 
nationals offered employment by U.S. companies, universities, and agencies. 

36 GAO-02-972. 
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reviewed thousands fewer overseas visa applications in fiscal year 2009 as 
compared to fiscal year 2001 because of a change in its procedures. The 
new procedures are more reactive because they focus on leads and 
intelligence information rather than proactive screening. According to 
these officials, the resulting change in procedures has led to better 
investigations; however, Commerce officials did not provide 
documentation to show how investigations were better. In technical 
comments provided on a draft of this report in November 2010, Commerce 
stated that a methodology that does not involve the review of every visa 
application does in fact constitute a proactive and effective approach. 
Commerce also stated that it would not be sound practice, with limited 
resources, to perform data reviews en masse of State's large database of 
visa cases, which could result in an overwhelming amount of data and 
unfocused research. However, we affirm our characterization that the new 
procedures are more reactive, as they rely on Commerce receiving leads or 
information, rather than proactively and routinely reviewing a portion of 
the database. 



Immigration and Licensing 
Data Suggest a Pool of 
Risk That Commerce Has 
Not Assessed 



Based on analysis of DHS and Commerce data from fiscal years 2004 
through 2009, we found that USCIS approved approximately 1.05 million 
foreign nationals from 13 countries of concern for specialty occupation 
visas, and Commerce approved deemed export licenses authorizing 
release of technology to approximately 3,200 foreign nationals from the 
same countries of concern (see fig. I). 37 This, combined with the other 
factors already described — intelligence and law enforcement sources; 
fines and suspensions for deemed export violations; and the reduced 
number of overseas visa applications that Commerce screens — could 
indicate a continuing risk of foreign nationals gaining unauthorized access 
to controlled technology. In particular, our analysis of DHS and Commerce 
data focused on companies, universities, and agencies hiring foreign 
nationals to work in such areas as computer technology and the biological 
sciences. Figure 1 compares the number of foreign nationals from 13 
countries of concern who worked in certain high-technology specialty 
occupations to the number of foreign nationals from the same countries 
who were covered by deemed export licenses for each fiscal year from 
2004 through 2009. It also shows the total numbers of specialty occupation 



J The DHS data were obtained from USCIS. We limited ourselves to analyzing H-1B 
specialty occupation visa data because ICE, which obtains student and visitor data, did not 
provide these data in time for this report. 
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visas and deemed export licenses authorizing release of technology to 
foreign nationals from the same countries of concern over the period of 
fiscal years 2004 through 2009. The figure also shows that while the 
number of deemed export licenses approved to cover foreign nationals 
from these countries of concern peaked in fiscal year 2004 at 655 and was 
lower in subsequent years, the number of foreign nationals approved to 
receive H-1B specialty occupation visas increased until fiscal year 2007 to 
204,095, then declined in fiscal year 2009 to 142,758. 



Figure 1 : Comparison of the Number of Foreign Nationals from Countries of 
Concern Approved to Receive Specialty Occupation Visas to Those Covered by 
Deemed Export Licenses, Fiscal Years 2004-2009 
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To address the serious shortage of qualified engineers and scientists, 
during fiscal years 2004 to 2009, the United States approved approximately 
1.7 million foreign nationals to work in the United States in certain high- 
technology occupational fields such as engineering, computers, the 
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biological sciences, and the physical sciences. This number includes about 
1.05 million specialty occupation visas that the United States approved for 
foreign nationals from 13 countries of concern. 

By comparing the overall number of foreign nationals from countries of 
concern receiving specialty occupation visas to work in high-technology 
occupations with the number of deemed export licenses issued, we found 
that Commerce issued deemed export licenses covering a relatively 
smaller number of foreign nationals from countries of concern. However, 
there is no requirement that a foreign national who holds a specialty 
occupation visa also be covered by a deemed export license. Furthermore, 
transfer of technology to multiple foreign nationals can be covered by a 
single deemed export license. 38 From fiscal years 2004 through 2009, 
Commerce approved deemed export licenses authorizing transfers of 
technology or source code to 3,178 foreign nationals of certain countries 
of concern. 39 Our comparison of USCIS and Commerce data showed 
specialty occupation visas for approximately 818,000 foreign nationals 
from one country or about 78 percent of the approximately 1.05 million 
total H-lBs approved during this time period, compared to deemed export 
licenses authorizing release of technology or source code to 444 foreign 
nationals from the same country. We found specialty occupation visas for 
approximately 149,000 foreign nationals from a second country compared 
to deemed export licenses authorizing transfer of technology or source 
code to 2,184 foreign nationals from the same country. Appendix II shows 
the number of foreign nationals approved by USCIS to receive certain 
high-technology H-1B specialty occupation visas from the 13 countries of 
concern that we selected as part of this review and the number of foreign 
nationals from the same countries that Commerce approved for deemed 
export licenses. 



A single deemed export license issued to a company may authorize the release of 
controlled technology to 10 or more foreign nationals to access controlled technology. 
However, Commerce data show that in some years the number of licenses approved was 
greater than the number of foreign nationals involved in the release of technology. 
Commerce officials explained that in some cases companies apply for more than one 
license for each foreign national because licenses tend to be narrowly focused with respect 
to the type of technology approved for release and the companies might need the foreign 
national to access more than one type of technology. 

39 Commerce approved 4,101 deemed export licenses in this period authorizing release of 
technology or source code to a total of 3,985 foreign nationals. 
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In technical comments on this report, Commerce stated that the report 
should put deemed exports in the context of the proportion of all exports 
to exports licensed by Commerce. Commerce concluded that the 
proportion of transactions requiring a Commerce license for deemed 
exports is about the right order of magnitude. It stated that the proportion 
of transactions requiring a Commerce license for actual exports — 0.3 
percent — is roughly the same as the proportion of high-technology visas 
identified by GAO to deemed export licenses — 1.05 million specialty 
occupation visas in high-technology fields and 3,200 deemed export 
licenses to foreign nationals (0.3 percent). However, Commerce provided 
no rationale for why the ratio of the number of all Commerce licenses to 
the number of all deemed export licenses should be comparable — or even 
relevant — to the proportion of specialty occupation visas compared to 
deemed export licenses. Commerce also stated other reasons that may 
explain the proportionately small number of deemed export licenses: (1) 
under the EAR, a technology license exception is available for release of 
controlled technology to nationals from three countries of concern, but is 
not reflected in licensing data; (2) the economic downturn from 2008 to 
the present has resulted in lower levels of hiring and investment by U.S. 
industry; (3) there has been a significant development of high-technology 
research and development offshore; and (4) the emergence of leading 
foreign research and technical schools has supplied more indigenous 
engineering and technology skills to foreign companies. 

In addition, the officials said that employers have an incentive to police 
themselves and reduce the number of opportunities for foreign nationals 
to obtain sensitive technologies for use in their home country since a loss 
of such proprietary information could pose a financial risk to employers. 
However, Commerce Office of Enforcement officials told us that many 
small-to-medium-size employers do not have mechanisms for protecting 
sensitive technologies. 

Our analysis of Commerce data shows that for fiscal years 2004 to 2009, 
foreign nationals from four countries of concern accounted for 79 percent 
of all the foreign nationals covered by deemed export licenses for this 
period. One country alone accounted for approximately 55 percent of the 
total. Figure 2 shows the percentage of foreign nationals from the four 
countries that received the most deemed export licenses during fiscal 
years 2004 through 2009 as well as the percentage of foreign nationals 
covered by deemed export licenses for fiscal years 2004 through 2009 from 
all other countries. 
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Figure 2: Percentage of Foreign Nationals Covered by Deemed Export Licenses 
from the Four Principal Countries of Concern, as well as Other Countries, Fiscal 
Years 2004-2009 
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Source: GAO analysis of Commerce deemed export licensing data. 



Our analysis of Commerce's deemed export licensing data for fiscal years 
2004 through 2009 showed a concentration of licenses in some of these 
technologies, particularly computers and electronics, but little change in 
the distribution of technologies licensed for release (see fig. 3). While our 
analysis identified some differences in the percentages of deemed export 
licenses approved for the individual categories of electronics and 
computers, the technologies of computers, telecommunications and 
information security, and electronics together comprised at least 80 
percent of the deemed export licenses issued in each fiscal year. 
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Figure 3: Composition of Technologies Listed in Deemed Export Licenses 
Approved in Fiscal Years 2004 through 2009 
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Source: GAO analysis of Commerce data. 

Note: Two CCL categories — marine; and nuclear materials, facilities, and equipment — are not listed 
because only one foreign national was approved for a deemed export license in these two technology 
categories. 
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Commerce and ICE 
Have Not 
Implemented 
Recommended 
Changes to the 
Deemed Export 
Licensing Process 
Involving Outreach, 
and Commerce Has 
Taken Actions to 
Clarify a Regulatory 
Definition but 
Confusion May 
Remain 



Commerce and ICE have not implemented recommended changes to the 
deemed export licensing process involving outreach. As a result, 
employers may be obtaining deemed export licenses for release of 
technology to fewer foreign nationals than should be the case. GAO and 
other audit organizations previously made two key recommendations to 
correct weaknesses in the deemed export licensing process. The first 
recommendation focused on providing better outreach to inform 
companies, universities, and agencies that employ foreign nationals of 
deemed export control requirements so they would apply for deemed 
export licenses when required. The second recommendation advised 
Commerce to modify the regulatory definition of "use" set forth in the 
EAR. Commerce has taken actions to clarify this definition, but confusion 
about its application may remain. 



Commerce and ICE Have 
Not Implemented Prior 
Recommendations to 
Improve Outreach to 
Companies, Universities, 
and Agencies 



Commerce and ICE have not implemented prior recommendations to 
improve outreach to companies, universities, and U.S. agencies to address 
weaknesses identified by GAO and the Commerce and DHS IGs. As a 
result, employers may be obtaining deemed export licenses for transfer of 
technology or source code to fewer foreign nationals than should be the 
case. The Commerce IG noted in 2004 that overall export licensing data 
and interviews with company officials suggested that Commerce was 
doing little to raise awareness of deemed export licensing requirements 
among companies and industry sectors that have not traditionally applied 
for deemed export licenses. Specifically, the Commerce IG reported that 
Commerce's outreach program for deemed export controls did not include 
entities other than those applying for export licenses for the release of 
export-controlled technology to foreign nationals in the United States. 
Overall, the lack of awareness and understanding of laws and regulations 
pertaining to the release of export-controlled technology to foreign 
nationals in the United States could harm national security if militarily 
sensitive technology is released to unauthorized foreign nationals, 
according to the Commerce IG. Similarly, in 2006, we reported that 
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Commerce needed to improve its efforts to provide information and 
outreach to companies and universities. 40 

In response to GAO's and the Commerce IG's recommendations that 
Commerce improve outreach to companies and universities, Commerce 
conducted deemed export outreach and prepared and adopted outreach 
plans; however, it did not implement all of these plans. Specifically, the 
Commerce IG recommended that Commerce develop written outreach 
plans. We also recommended that, among other things, Commerce use 
immigration, student, and other data to more precisely target outreach 
activities to companies and universities based on an assessment of the 
vulnerabilities of their use of controlled information, improve interagency 
coordination, and conduct additional outreach. Commerce IG 
recommended that Commerce's strategic outreach plan for exports of 
controlled technology to foreign nationals in the United States have annual 
goals and identify priority industries, federal agencies, and academic 
institutions that are not currently applying for export licenses for the 
release of export-controlled technology to foreign nationals in the United 
States. Commerce stated that it would continue to identify priority 
industries and conduct outreach to small- and medium-sized businesses 
and defense contractors to educate those types of companies about dual- 
use export control rules involving deemed exports. In addition, Commerce 
stated that it had already targeted outreach in the area of biotechnology by 
discussing export policies and procedures with the biotechnology industry 
and academia, as well as visits to U.S. government research labs, 
universities, small business associations, and foreign student associations. 
Among other things, to better identify emerging priority technologies for 
inclusion on the CCL, Commerce established an Office of Technology 
Evaluation in fiscal year 2006. 

However, our analysis of Commerce's Export Administration's outreach 
plans for fiscal years 2004 and 2005 found they did not include a strategy 
to improve outreach, but instead listed organizations that Export 
Administration decided to meet with during the year. 41 While Commerce 
did prepare and adopt a strategy for outreach as part of an enhanced 
deemed export initiative for the fourth quarter of fiscal year 2007 and 
fiscal year 2008, according to agency officials, it never implemented the 



4U GAO-07-69; GAO-07-70. 

41 We requested a copy of Commerce's fiscal year 2006 outreach plan on at least two 
occasions, but Commerce did not provide a copy. 



Page 24 



GAO-11-354 Export Controls 



outreach plan due to funding constraints and eventually provided outreach 
to only about 11 percent of the approximately 300 companies and 
universities it had originally targeted. The strategy explicitly recognized 
that Commerce needed to better inform companies in sectors of the 
economy that have not traditionally applied for deemed export licenses, 
specifically, biotechnology, and to use specialty occupation H-1B data and 
student data to better target outreach. 42 In addition, the deemed export 
initiative included an additional $2.6 million in fiscal year 2006 to hire eight 
additional staff to focus on such things as enhanced deemed export 
outreach. However, Commerce officials stated that a budget cut of 
approximately 3 percent that occurred during fiscal year 2007 and the 
departure of the three staff hired under the deemed export initiative 
adversely affected the fourth quarter fiscal year 2007 and fiscal year 2008 
outreach plan. As of August 2010, Commerce had not replaced the staff 
and currently has not assigned any staff to focus exclusively on deemed 
export outreach. According to Commerce Export Administration officials, 
they currently do not have a national outreach plan focused on deemed 
exports. However, Commerce does conduct outreach specific to deemed 
exports and includes the topic of deemed exports in overall export control 
seminars. According to Commerce, it began conducting seminars focused 
exclusively on deemed exports in January 2006. 43 

Similarly, Commerce's Office of Export Enforcement also conducts 
outreach to inform companies, universities, and agencies about deemed 
export licensing requirements, but lacks a national outreach plan, 
according to Office of Export Enforcement officials. Commerce Office of 
Export Enforcement officials told us that each of Commerce's nine export 
enforcement field offices could develop outreach plans for their areas of 
jurisdiction. However, we found that none of the three Commerce field 
offices in the cities that we visited — Boston, Los Angeles, and San 
Francisco — had developed such plans. 

ICE has taken actions in response to the DHS IG's 2004 recommendations 
that it improve its deemed export outreach, but continues to lack written 



In comments provided to us in November 2010, Commerce stated that its understanding 
of the types of companies that attend its export control seminars is limited because it does 
not collect the data needed to distinguish between small, medium-sized, and large 
companies. It further noted that it has published a Notice of Inquiry in the Federal Register 
requesting input on the impact of export controls on small and medium-sized enterprises. 

43 Commerce also began offering Webinars focusing on deemed exports as early as August 
2007. 
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guidance for its agents on what information outreach activities should 
present. The DHS IG found that ICE had not incorporated into its outreach 
written guidance or a checklist for Project Shield America that agents 
could refer to when selecting export control topics to present during their 
outreach visits. The DHS IG noted that without adequate guidance about 
export laws and regulations, particularly those specific to deemed exports, 
agents might fail to present this critical information. It recommended that 
ICE implement standard operating procedures and a standardized 
checklist of items as part of its Project Shield America outreach to 
companies, universities, and agencies to ensure that the release of 
controlled technology to foreign nationals is included in ICE 
presentations. ICE concurred with this recommendation. ICE has 
developed a component for deemed export outreach and investigations 
known as Operation Tech Defense as part of Project Shield America. 
However, since fiscal year 2004, ICE has reduced the number of outreach 
activities by approximately 35 percent (from 2,322 outreach meetings in 
fiscal year 2004 to 1,504 in fiscal year 2009) and, like Commerce, lacks a 
national outreach plan. 44 

FBI officials stated that its field offices also develop local outreach plans 
and that FBI considers outreach on deemed exports to be an integral part 
of its outreach; however, agency officials noted that it does not have any 
outreach focused exclusively on deemed exports. Although both ICE and 
FBI officials in Washington told us that outreach plans are developed 
locally, we found that none of the ICE and FBI field offices in the cities 
that we visited had developed such plans. ICE and FBI officials in Boston, 
Los Angeles, and San Francisco said that resource constraints made it 
difficult to prepare such plans. 

We found that the Commerce IG's critique of Commerce's outreach 
activities in 2004 — a lack of focus on companies other than those that 
were applying for licenses and a general lack of awareness of deemed 
export laws and regulations among other companies — pertained to 
Commerce, ICE, and FBI in the cities we visited. According to Commerce, 
ICE, and FBI officials in the three cities where we conducted field work, 
the three agencies tended to focus their deemed export outreach on the 
same types of companies and universities — principally larger companies, 



ICE statistics show that the number of outreaches dropped significantly from about 2,300 
in fiscal year 2004 to about 1,600 in fiscal year 2005 and have averaged about 1,450 
outreaches per year. 
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universities, and agencies that are either defense contractors or are 
undertaking major defense-related work. None could demonstrate that 
they have focused their attention on the small-to-mid-size companies, such 
as biotechnology companies, that officials of all three agencies told us are 
least likely to be aware of deemed export licensing requirements. 
Commerce licensing officials, Commerce, ICE, and FBI law enforcement 
officials, and representatives of most of the 33 companies, universities, 
and agencies that we met with as part of our field work stated that many 
small-to-mid-size companies, particularly in quickly expanding fields such 
as biotechnology, are not aware of deemed export licensing requirements. 
Commerce, ICE, and FBI officials attributed the lack of awareness to the 
sheer number of such companies and the lack of staffing to address these 
numbers. For instance, FBI officials told us that in the San Francisco Bay 
Area alone there are close to 500 biotechnology companies, most of which 
are small-to-mid size, and only a limited number of Commerce, ICE, and 
FBI officials to provide outreach. 45 

In written comments on this report, the FBI stated it has conducted 
deemed export outreach to small-to-mid-size biotechnology companies 
through several venues, including strategic task forces, counterintelligence 
working groups, conferences, and other initiatives in coordination with the 
U.S. intelligence community and federal law enforcement agencies, 
including ICE and Commerce. However, FBI did not provide us with 
evidence of this outreach except for a single-page document whose details 
about the companies that the FBI met with had been entirely redacted. For 
that reason, we cannot validate the FBI's assertion. 

Appendix III provides a summary of Commerce's and ICE's outreach 
seminars, conferences, meetings, discussions, and e-mails during fiscal 
years 2004 through 2009. As FBI classified its outreach data, we cannot 
present it in this report. 



45 Commerce and ICE officials provided us with the number of staff in their San Francisco 
Bay Area offices that are dedicated full time to export control activities; however, FBI 
officials told us they could not provide the number of staff dedicated full time to export 
control activities because they do not track the information in this manner. 
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Commerce Has Taken 
Actions to Clarify the 
Regulatory Definition of 
"Use" Technology but 
Confusion About Its 
Application May Remain 



In response to a Commerce IG recommendation to modify the definition of 
"use" technology that determines whether a deemed export licensing 
requirement is triggered, Commerce has clarified the definition. However, 
as one example shows, this clarification may not have eliminated the 
confusion surrounding the application of this regulation. In March 2004, 
the Commerce IG stated that confusion exists over what is meant by "use" 
of EAR-controlled equipment by foreign nationals, especially in relation to 
fundamental research. 46 According to Commerce's interpretation, "use" 
technology is specific information necessary to perform all six of the 
following activities: installing, operating, maintaining, repairing, 
overhauling, and refurbishing an item. 47 If the technology available to the 
foreign national does not meet all six of these attributes, then it is not 
"use" technology for deemed export licensing purposes. For example, if a 
foreign national only has access to information that is necessary to 
"operate" equipment, as opposed to information necessary for all 
six activities, a release of "use" technology to the foreign national has not 
occurred. Consequently, the information at issue would not be subject to 
the EAR and, hence, no license requirement would apply. According to 
Commerce officials, the definition is designed to allow foreign nationals 
conducting research to operate controlled equipment, while at the same 
time preventing these individuals from reverse-engineering the equipment. 
The Commerce IG pointed out that the definition was confusing because it 
did not take into account that controlled information is often transferred 
to foreign nationals as part of the process of training the foreign national 
to operate the machine. 48 As evidence of the confusion, the Commerce IG 



National Security Decision Directive 189 defines fundamental research as basic and 
applied research in science and engineering, the results of which ordinarily are published 
and shared broadly within the scientific community. Examples include work on nuclear 
engineering, lasers, sensors, ceramics, radars, and virology. The EAR states that certain 
technology and software that arise during or result from fundamental research, the results 
of which are intended to be published, are not subject to deemed export licensing 
requirements. 

47 15 C.F.R. 772.1 and "Questions and Answers to Supplement Clarification of Deemed 
Export Related Regulatory Requirements" at http://www.bis.doc.gov/deemedexports/ 
deemedexportssupplementqa.html, last visited September 30, 2010. 

4S The DEAC also noted that the definition of "use" for a deemed export license appeared 
not to withstand the test of logical consistency, since the definition could allow two 
individuals working in collusion to perform enough functions to gain full knowledge of all 
six activities without triggering a requirement for a deemed export license. Commerce 
officials noted in technical comments provided to us in November 2010 that such a 
circumstance could constitute an evasion of the EAR and evasion would be a prosecutable 
violation of the EAR. 
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reported on differences among Commerce senior licensing officials, 
multilateral export control regimes, and DTSA in interpreting "use" as 
applied in the CCL and the control lists from the four multilateral export 
control regimes. These differences in interpretation are critical in 
determining how to implement and enforce the deemed export provisions 
in the EAR, according to the Commerce IG. For instance, while some of 
the university and U.S. government officials who spoke to the Commerce 
IG said they believed that "use" technology in the context of fundamental 
research is exempt under the regulations, Commerce holds that "use" 
technology is subject to the deemed export provisions regardless of 
whether the research being conducted with that equipment is fundamental 
or not. The IG reported that many university and government laboratories 
would need to seek deemed export licenses for some foreign nationals 
working with controlled equipment or otherwise restrict their access to 
such equipment. 

In response to the Commerce IG's recommendation, Commerce stated that 
it would work with State and DOD to determine whether the definition of 
"use" technology should be modified, and has taken actions to clarify the 
definition as of May 2006. In 2005, Commerce sought public comments 
prior to making any revision to the regulation, and companies and 
universities raised numerous concerns about the proposed revision. 49 In a 
May 2006 Federal Register notice, Commerce clarified that all of the 
activities listed in the definition of "use" technology are required to trigger 
a deemed export licensing requirement, and did not modify its definition. 50 
Commerce stated that this clarification resolved any inconsistency 
suggested by the IG report. 51 Commerce also posted questions and 
answers on its Web site to provide additional information clarifying 
deemed export regulatory requirements in response to the IG report. 52 
Despite these actions taken by Commerce, the IG does not believe that 
Commerce fully implemented its recommendation to modify the definition 
of "use" of EAR-controlled equipment by foreign nationals. 



Revision and Clarification of Deemed Export Related Regulatory Requirements, 70 Fed. 
Reg. 15,607 (Mar. 28, 2005). 

50 71 Fed. Reg. 30,840. 

51 j- i 

Id. 

o2 http://www.bis.doc.gov/deemedexports/deemedexportssupplementqa.html. 
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However, as shown by uncertainty within Commerce over the definition of 
"use" technology that resulted in a misunderstanding with NIH, 
Commerce's clarification may not have eliminated the confusion. Based on 
guidance from Commerce on the definition of "use" technology, NIH 
applied for 37 deemed export licenses, which Commerce processed over a 
17-month period before verbally advising NIH that it no longer needed to 
apply for such licenses, though the definition itself remained the same. A 
May 2007 Commerce presentation discussing Commerce's clarification of 
the definition of "use" technology raised concerns among NIH officials that 
they might now be subject to deemed export licensing requirements, since 
they employed foreign nationals to work in new highly secure laboratories 
with controlled technologies, according to NIH officials. Prior to this 
presentation, NIH had considered itself not subject to these requirements 
because its research was fundamental. As a result, NIH initially requested 
additional guidance from Commerce about deemed export licenses in 
April 2008, according to NIH officials and documents. In response to the 
NIH inquiry, Commerce said that NIH should apply for a deemed export 
license, according to NIH officials. From August 2008 to December 2009, 
NIH applied for 37 deemed export licenses out of concern that it might be 
subject to deemed export licensing requirements; Commerce approved 28 
and returned without action 9 others. In February 2009, a Commerce e- 
mail to NIH raised further concerns by requesting a letter of explanation 
for the presence of foreign national scientists in NIH laboratories without 
appropriate deemed export licenses during the time period when NIH had 
considered itself not subject to these requirements. However, according to 
NIH officials and e-mails, in December 2009, a Commerce official verbally 
informed NIH that it could in fact claim the fundamental research 
exemption and need apply for no further deemed export licenses, based 
on the definition of "use" technology. Commerce officials said the 
confusion over the NIH's employment of foreign nationals to work in the 
new laboratories was solved due to a better understanding of NIH's 
business process in relation to the definition of "use" technology and 
fundamental research. 
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Commerce and Other 
Agencies Have Not 
Implemented 
Recommended 
Changes to Improve 
Enforcement of 
Deemed Exports 



Commerce and other agencies have not implemented recommendations 
that we and the Commerce IG made to improve the enforcement of 
deemed exports. First, notwithstanding our 2002 and the Commerce IG's 
2004 recommendations for Commerce to establish a program to monitor 
companies', universities', and agencies' compliance with deemed export 
license security conditions, Commerce continues to lack such a program. 
Second, in its efforts to detect unlicensed deemed exports, Commerce 
does not use all existing DHS immigration data, notwithstanding our 2002 
recommendation that it make more use of such data. Finally, 
notwithstanding our 2006 report recommendation to enhance 
coordination, Commerce, ICE, and FBI continue to lack written 
agreements defining the current roles and responsibilities among agencies. 
Officials said that deemed export enforcement coordination continues to 
be a challenge after the creation of interagency export enforcement task 
forces and networks. 



Commerce Continues to 
Lack a Program to Monitor 
Compliance with License 
Security Conditions 



Commerce continues to lack a monitoring system to ensure companies', 
universities', and agencies' compliance with security conditions in deemed 
export licenses. Officials at Commerce's enforcement field offices in 
Boston, Los Angeles, and San Francisco stated that Commerce does not 
currently have a program to monitor compliance with firms' deemed 
export license security conditions — notwithstanding our 2002 and the 
Commerce IG's 2004 recommendation to create such a program. 

In 2002, we reported that Commerce did not have a program to monitor 
compliance with the license security conditions imposed on almost all 
deemed export licenses approved. 53 We recommended that Commerce 
work with DOD, State, and Energy to develop a risk-based program to 
monitor compliance with deemed export licensing security conditions. In 
response, Commerce asserted it had an effective monitoring system but 
stated it would explore the practicality of our recommendation. 54 

The Commerce IG has also reported that Commerce lacks a monitoring 
system to ensure compliance with security conditions in deemed export 
licenses. In 2004, the Commerce IG reported that Commerce was not 



OJ GAO-02-972. 

54 We disagreed with Commerce's assertion because its monitoring system then consisted of 
conducting administrative checks to ensure that firms were submitting the correct 
paperwork. 
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performing on-site inspections or reviews to ensure compliance with 
export laws and regulations related to controls over the release of export- 
controlled technology to foreign nationals in the United States. The IG 
stated that the lack of compliance, monitoring, and adequate policies 
could degrade the integrity of the interagency licensing process. The 
Commerce IG further reported that because Commerce was not 
performing on-site inspections or reviews of entities holding an export 
license for the release of export-controlled technology to foreign nationals 
to ensure compliance with license conditions, license holders were not 
held accountable for complying with license conditions. Commerce 
informed the IG that it was not monitoring compliance with any deemed 
export licenses because it did not have the resources to do so. As a result, 
the IG concluded that the same companies were continually receiving 
export licenses for the release of export-controlled technology to foreign 
nationals regardless of whether they complied with previous license 
conditions. The IG recommended that Commerce develop a compliance 
program to effectively evaluate deemed export license holders' 
compliance with license conditions. In response to the IG's 
recommendation, Commerce stated that it would establish a pilot program 
to determine compliance with deemed export license conditions. 

In fiscal year 2006 Commerce established a program to monitor licensing 
conditions, but discontinued it after fiscal year 2007. Commerce officials 
cited competing priorities and budget constraints as factors that resulted 
in the discontinuation of this program. 

DOD officials told us in 2002 that deemed export licenses need these 
security conditions to mitigate the risk to U.S. national security of 
releasing controlled dual-use technology to certain foreign nationals. DOD 
officials repeated this assertion to us in August 2010. Commerce uses 
several of these security conditions to limit the level of technology for 
transfer to foreign nationals who may be in employment or academic 
settings in which an entity might require deemed export licenses for 
release of controlled technology to the foreign national. For example, 
security conditions might bar foreign nationals from (1) unmonitored use 
of high-performance computers, (2) involvement in the design of 
computers that exceed a specified performance limit, and (3) accessing 
technical data on advanced microprocessors or certain types of 
lithography equipment. DOD officials said that security conditions are 
critical to DOD's willingness to recommend approval for many deemed 
export license applications during the interagency deemed export license 
review process. 
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Although Commerce lacks a monitoring system to ensure this compliance, 
it includes language in many deemed export licenses requiring applicants 
to develop procedures for ensuring compliance with such security 
conditions in approved licenses and to provide copies of these procedures 
to Commerce. These instructions specify that Commerce "will monitor 
[security conditions] to ensure that the applicant's compliance is 
effective." 55 



Commerce Does Not Use 
All Existing DHS 
Immigration Data to 
Detect Potential 
Unlicensed Deemed 
Exports 



Notwithstanding our 2002 recommendation, Commerce does not screen all 
DHS immigration data — H-1B change-of-status visa applications submitted 
domestically — to identify foreign nationals who may be engaging in 
release of technology or source code that requires a deemed export 
license. During fiscal years 2004 through 2009, about 361,000 foreign 
nationals applied for a change of status to an H-1B visa within the United 
States. Our 2002 report found that Commerce did not screen thousands of 
Immigration and Naturalization Service (whose function processing 
applications for immigration benefits was placed within USCIS) 
immigration applications from foreign nationals already in the United 
States. We recommended that Commerce use these immigration data to 
identify foreign nationals who could be engaging in a transfer of 
technology or source code requiring a deemed export license. Concurring 
with this recommendation, Commerce consulted DHS, which suggested 
the establishment of a referral process so that any changes in visa status 
potentially requiring deemed export licenses are forwarded to Commerce 
for review. The DHS IG reported in 2004 that DHS was not providing 
information to Commerce that could support its efforts to identify and 
investigate potential violations related to the release of export-controlled 
technology to foreign nationals. As a result, information from thousands of 
change-of-status visa applications filed domestically with USCIS was not 
reviewed to generate investigative leads for Commerce, according to the 
IG. The IG recommended that USCIS provide Commerce with access to 
data from foreign nationals' approved change-of-status applications to 
help identify possible investigative leads for follow up. DHS management 
concurred with these recommendations. 



USCIS began in early 2010 to respond to these recommendations to screen 
thousands of DHS immigration change-of-status visa applications 



' °Department of Commerce, Bureau of Industry and Security, "Guidelines for Preparing 
Export License Applications Involving Foreign Nationals." 
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submitted domestically by proposing a revision of the USCIS form that 
employers must complete, which among other things would change a 
foreign national's immigration status to H-1B specialty employment. 
Commerce officials said that they have been working with USCIS to make 
such data easier to analyze. As a result of this collaboration, USCIS issued 
notices in the Federal Register in February and June 2010 requesting 
comments about a proposed change to the form employers must complete 
to change a foreign national's immigration status to H-1B specialty 
employment, request an extension of status, or employ a foreign national 
outside the United States. 56 This change will require employers to 
acknowledge if the position for which they want to hire a foreign national 
could require a deemed export license. In August 2010, USCIS officials told 
us that the comment period had ended and the revised form containing the 
proposed change had been submitted to the Office of Management and 
Budget for review. 57 According to USCIS, in October 2010 the Office of 
Management and Budget approved the revision to the form. However, 
USCIS noted it is not able to electronically track employers' responses to 
this new section of the form. See appendix IV for a draft of the form 
change. 

In addition to making it easier for Commerce to screen thousands of H-1B 
change-of-status visa applications submitted domestically, Commerce, 
ICE, and FBI officials said that, if implemented, the addition of a "deemed 
export acknowledgement" section to the form could make it easier to 
enforce deemed export control regulations by helping to ensure that 
companies employing foreign nationals endeavor to comply with the EAR. 
Since our 2002 report, the U.S. government levied criminal convictions and 
civil penalties totaling about $2.3 million against 14 companies and two 
individuals for violating deemed export regulations. Commerce, Justice, 
ICE, and FBI officials told us that one reason for the low number of 
criminal convictions and civil penalties is the difficulty of proving that an 
individual or organization willfully intended to violate deemed export 
regulations. According to Commerce, "willful intent" is a criminal standard 



Agency Information Collection Activities: Form 1-129, Revision of an Existing Information 
Collection; Comment Request, 75 Fed. Reg. 6,212 (Feb. 8, 2010); and Agency Information 
Collection Activities: Form 1-129, Revision of an Existing Information Collection; Comment 
Request, 75 Fed. Reg. 37,822 (June 30, 2010). According to USCIS, other nonimmigrant visa 
categories will also be required to file the deemed export certification. 

57 Under the Paperwork Reduction Act of 1980 (Pub. L. No. 96-511, 94 Stat 2812 ) the Office 
of Management and Budget is required to review all proposed changes in government 
forms that could result in an added collection burden on the public. 
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that only applies in the context of criminal deemed export prosecution. 
According to Commerce, while a deemed export certification would rarely 
provide sufficient evidence to prove that an entity willfully intended to 
violate deemed export regulations, it could be used to support a false 
statement charge or other violation of the EAR. This could potentially lead 
to an increase in the number of successful deemed export investigations 
resulting in penalties. 



Changes that Commerce, Justice, ICE, and FBI have made since our 2006 
report to enhance coordination among export enforcement agencies have 
not fully resolved deemed export enforcement coordination weaknesses, 
according to officials of these agencies in areas we visited. In order to 
address overall weaknesses in export enforcement coordination, our 2006 
report recommended that the enforcement agencies establish a task force 
to evaluate options to improve coordination and cooperation among 
export enforcement investigative agencies. These options could include 
(1) creating new or updating existing operating agreements between and 
among these agencies, (2) identifying and replicating best practices for 
routinely collaborating on or leading investigations, and (3) establishing a 
mechanism for clarifying roles and responsibilities for individual export 
control cases involving foreign counterintelligence. 

Justice and ICE made changes in response to these recommendations, but 
these changes have not fully resolved the coordination weaknesses, 
according to Commerce, ICE, and FBI officials. According to Justice 
officials, Justice began setting up Counter-Proliferation Task Forces in 
several judicial districts throughout the country beginning in 2008. In 
addition, Justice has established a Technology Protection Enforcement 
Group to improve coordination among the export enforcement agencies at 
senior levels. Moreover, according to ICE, the three agencies have 
collaborated with one another to improve matters related to deemed 
exports as part of the interagency task force established by the President 
in August 2009 to examine export control reforms. However, officials from 
Commerce, ICE, and FBI said the task forces have not fully resolved 
coordination challenges in part because each agency maintains discretion 
over the degree of its participation in the task forces. Moreover, outdated 
or absent written agreements among agencies have not defined 
overlapping enforcement jurisdictions. ICE established the National 
Export Enforcement Coordination Network (NEECN) in fiscal year 2007 
to coordinate investigations by DHS, law enforcement, intelligence, and 
foreign officials to prevent countries of concern from acquiring controlled 
technologies. Commerce, ICE, and FBI officials told us that 



Changes That Commerce, 
Justice, ICE, and FBI 
Implemented Have Not 
Fully Resolved Deemed 
Export Enforcement 
Coordination Weaknesses, 
According to Officials 
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representatives from their agencies attend weekly NEECN meetings where 
participants coordinate export control investigations and may work to 
resolve conflicts among agencies. However, ICE officials stated that 
NEECN primarily focuses on investigations involving the export of goods, 
rather than deemed exports. 

Deemed export enforcement coordination challenges among Commerce, 
ICE, and FBI stem in part from overlapping jurisdictions and the lack of 
defined roles and responsibilities among these agencies. 58 For example, 
Commerce officials said that ICE does not always coordinate with 
Commerce to ensure that ICE transfers cases without criminal penalties 
that require additional follow up to Commerce so that it may consider civil 
penalties. Commerce and DHS officials said that coordination and 
collaboration among deemed export enforcement agencies became more 
challenging in 2004 when the Attorney General reiterated the FBI's role as 
the lead enforcement agency in all export control cases "relating to any 
foreign counterintelligence matter." 59 Commerce and ICE officials said 
that coordination with FBI can be particularly challenging because FBI 
often classifies information for investigations — making it more difficult for 
Commerce and ICE officials to use information originating from the FBI 
due to its classification. Commerce, FBI, and ICE officials said that 
coordination and cooperation continue to hinge on the relationships 
between individual investigators across agencies in the absence of current 
formal agreements. A 1993 agreement between Customs and Commerce 
outlines the investigative responsibilities of each agency, but it does not 
reflect departmental changes that occurred as a result of the establishment 
of DHS in March 2003 — including the creation of ICE. In addition, ICE and 
FBI do not have any formal agreement for collaboration to coordinate 
cases involving export control violations. Because the enforcement 
agencies do not have formal agreements for collaboration, the lack of 
defined roles and responsibilities persists. 



According to FBI, it has been designated to take charge of investigative work in matters 
relating to espionage, sabotage, subversive activities, and related matters, including 
investigating any potential violations of the Arms Export Control Act, the Export 
Administration Act, the Trading with the Enemy Act, or the International Emergency 
Economic Powers Act, relating to any foreign counterintelligence matter. 

59 Delegations of Authority; Federal Bureau of Investigation, 69 Fed. Reg. 65,542 (Nov. 15, 
2004). 
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In 2002 we reported that the deemed export licensing system did not 
provide adequate assurance that U.S. national security interests were 
protected from countries that gather information on dual-use technologies 
to build weapons systems. This conclusion remains relevant today. In the 8 
years since the publication of our report and its recommendations, we and 
other organizations have issued additional reports with further 
recommendations to strengthen the deemed export system. Nonetheless, 
Commerce and other agencies have not implemented key recommended 
changes. As a result, U.S. agencies acknowledge the continued risk of 
releasing controlled technologies to foreign nationals in the United States, 
particularly in rapidly expanding sectors of the economy such as 
biotechnology. Commerce has reduced its screening of overseas visa 
applications that it had used to refer to enforcement offices to help 
determine if companies should have applied for deemed export licenses 
and for outreach and does not screen thousands of H-1B change-of-status 
visa applications submitted domestically. The United States approved 
about a million foreign nationals from 13 countries of concern to work in 
high-technology occupations in the United States, while approving deemed 
export licenses for a much smaller number of foreign nationals from the 
same countries to work in related technologies. Although not all are 
required to have deemed export licenses, the approximately 1 million 
foreign nationals with specialty occupation visas from the 13 countries of 
concern that we identified in our work represent a pool of risk that 
Commerce could use to assess the nature and scope of compliance with 
deemed export requirements and to better direct outreach and 
enforcement efforts. Until the scope of the risk is assessed, it will be 
difficult for U.S. agencies to determine where their outreach, monitoring, 
and enforcement efforts should be focused and to know how to correct 
the deficiencies that we and the Inspectors General have reported in the 
past. The executive branch has announced plans to reform the export 
control system, including the export licensing and enforcement systems 
for deemed exports. Resolving the deficiencies identified repeatedly since 
2002 could be important to the effectiveness of any new export control 
reform. 



Recommendations for 
Executive Action 



We recommend the Secretary of Commerce take the following two 
actions: 

To better direct its efforts to detect possible unauthorized deemed exports 
and conduct outreach, in consultation with the U.S. Attorney General and 
the Secretary of Homeland Security, assess the extent to which foreign 
nationals from countries of concern who were issued specialty occupation 
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visas also should have been covered by deemed export license 
applications. This assessment, using all available data from the three 
agencies, might involve reviewing a sample of H-1B specialty visas for 
employment in particular technologies, such as computers, electronics, or 
biotechnology, to determine whether employers of the applicants should 
have applied for deemed export licenses. The Secretary should use the 
results of this assessment to identify the vulnerabilities in the deemed 
export control system; plan to better target and inform companies, 
universities, and agencies about deemed export licensing requirements; 
and develop and implement procedures for incorporating DHS 
immigration data into its enforcement screening activities. 

• To ensure that Commerce takes actions to more fully address the 
deficiencies identified in this and prior reports as part of any export 
control reform effort, report to Congress the specific steps being taken to 
implement past GAO and Commerce IG recommendations in the context 
of the current Export Control Reform Initiative. These recommendations 
relate to (1) improving outreach; (2) implementing a program to monitor 
compliance with deemed export license security conditions; (3) screening 
foreign nationals who change their immigration status in the United States 
for deemed export requirements; and (4) improving coordination among 
the law enforcement agencies responsible for enforcing deemed export 
license regulations. 



We provided a draft of this report for comment to the Departments of 
Commerce, State, Defense, Homeland Security, Justice, and Energy; as well 
as the FBI and NIH. Commerce and FBI provided written comments, while 
the Departments of State, Defense, and Energy, and NIH did not provide 
comments. The Departments of Commerce and Homeland Security, and FBI 
provided technical comments, which we have incorporated as appropriate. 

In its written comments, Commerce agreed with our recommendation to 
assess the extent to which foreign nationals from countries of concern 
who were issued specialty occupation visas also should have been covered 
by deemed export licenses and use the results to identify vulnerabilities in 
the deemed export control system, target and inform employers about 
deemed export licensing requirements, and incorporate immigration data 
into its enforcement screening activities. Commerce also stated that it 
would review prior GAO and Inspectors General recommendations as part 
of the ongoing Export Control Reform process. However, Commerce did 
not comment on our recommendation to report to Congress on the steps 
being taken to implement past GAO and Commerce IG recommendations. 



Agency Comments 
and Our Evaluation 
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We believe that this recommendation remains valid because resolving the 
deficiencies in deemed export licensing and enforcement identified 
repeatedly since 2002 could be critical to the success of any export control 
reform initiative. Commerce's written comments are contained in 
appendix V. 

In its written comments, FBI stated it has conducted deemed export 
outreach to small-to-midsize biotechnology companies through several 
venues, including strategic task forces, counterintelligence working groups, 
conferences, and other initiatives, in coordination with the U.S. intelligence 
community and federal law enforcement agencies, including ICE and 
Commerce. FBI also stated that through participation in the NEECN and 
other arenas, FBI, ICE, and Commerce have worked to resolve coordination 
of export enforcement activities. In our report, we discuss the role of the 
NEECN, which ICE established to help coordinate export control 
investigations, but note that ICE officials told us that the NEECN primarily 
focuses on export control investigations involving goods, rather than 
deemed exports. Finally, FBI also commented on the relationship between 
additional attention on deemed exports and the need for more resources for 
outreach and investigation. We did not address this topic in the scope of our 
work. FBI's written comments are contained in appendix VI. 



As agreed with your office, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will send copies of this report to the Attorney 
General; the Secretaries of Commerce, Defense, Homeland Security, and 
State, and other interested parties or interested congressional committees. 
In addition, the report will be available at no charge on the GAO Web site 
at http://www.gao.gov. 
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If you or your staff have questions about this report, please contact me at 
(202) 512-8979 or at christoffj@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. GAO staff who made key contributions to this report are 
listed in appendix VII. 




Joseph A. Christoff 

Director, International Affairs and Trade 
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Appendix I: Scope and Methodology 



To examine the risk that foreign nationals in the United States may gain 
unauthorized access to controlled dual-use technologies, we reviewed 
unclassified assessments discussing the methods that countries use to 
illicitly obtain controlled technologies and the technologies most at risk. 
These include the Annual Report to the Congress on Foreign Economic 
Collection and Industrial Espionage issued during fiscal years 2002-2008 
by the Office of the National Counterintelligence Executive. Using law 
enforcement data, we also documented the total number of deemed export 
violations committed during the 2002-2009 period. Not all foreign nationals 
approved for H-1B visas work in occupations that could involve controlled 
technology. For this reason, to estimate the risk that foreign nationals 
working in high-technology fields could gain unauthorized access to 
controlled technology, we selected four broad specialty occupation fields 
based on an examination of the categories of technology contained in the 
Export Administration Regulations (EAR) and a review of unclassified 
reports detailing the types of dual-use technologies that countries are 
attempting to obtain. The four broad specialty occupation fields we 
selected were occupations in the computer, engineering, and physical and 
biological sciences, including biotechnology. We excluded other H-1B 
occupational fields such as those in the social sciences, the arts, and 
modeling because these typically do not involve work in researching or 
manufacturing high-technology applications. We then quantified the 
number of foreign nationals approved for the specialty occupation visas in 
these four broad specialty occupations from 13 countries of concern using 
U.S. Citizenship and Immigration Service (USCIS) immigration data for 
fiscal years 2004-2009. We selected this time period due to data reliability 
concerns about data produced before fiscal year 2004. 

The countries of concern whose foreign nationals we included as part of 
this report were selected based on several sources. First, the EAR groups 
countries into five main groups (A through E) by their level of restrictions 
and concern, varying from country to country. The most restricted 
destinations — those in country group E — are the embargoed countries and 
those countries designated as supporting terrorist activities. The next most 
restricted destinations — those in country group D — are those for which 
worldwide restrictions on some products apply, controlling items for 
national security, and nuclear, chemical/biological, and missile 
proliferation reasons. We judgmentally selected six countries from country 
group D to which Commerce applies at least three of the four reasons for 
control. In addition, we selected two additional countries of concern 
based on (1) intelligence reports and discussions with U.S. law 
enforcement officials, (2) an analysis of trends in deemed export 
enforcement cases from fiscal years 2002 through 2009, and (3) the 
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Appendix I: Scope and Methodology 



publicly reported associations of one country's citizens with export 
enforcement cases over the past several years. We assessed the reliability 
of USCIS and Commerce data by reviewing reports discussing the 
limitations of these databases and meeting with USCIS and Commerce 
officials responsible for managing the databases. Based on the information 
obtained, we determined the data were sufficiently reliable for our use. 

To examine the extent to which Commerce and other agencies have 
implemented recommended changes to the deemed export licensing 
process, we reviewed the recommendations made in GAO and Commerce 
and interagency Inspectors General reports issued during fiscal years 
2002-2009 as well as the report issued by the Deemed Export Advisory 
Committee (DEAC). Based on the information in these reports, we 
documented the concerns raised in the reports and the agency's response. 
We provided Commerce with a matrix summarizing the concerns raised 
and the agency's responses and obtained its views. We met with officials 
of the agencies responsible for reviewing license applications in 
Washington, D.C. — principally Commerce, but also the Departments of 
State, Defense, and Energy — to determine how information is shared, as 
well as the agencies that conduct outreach and enforce compliance with 
licensing conditions and regulations — Commerce, ICE, and FBI. We met 
with 33 associations, companies, nonprofits, universities, and state 
government agencies to obtain their views about the extent to which 
companies, universities, and firms are familiar with deemed export license 
regulations. These were judgmentally selected based on our review of 
Commerce's fourth quarter fiscal year 2007 and fiscal year 2008 outreach 
plan, which showed that Commerce planned to focus on biotechnology as 
one of several areas for outreach and an examination of the USCIS H-1B 
specialty occupation visa database. 

To examine the extent to which Commerce and other agencies have 
implemented recommended changes to the deemed export enforcement 
system, we reviewed the recommendations contained in GAO, and 
Commerce and interagency Inspectors General reports issued during fiscal 
years 2002-2008, as well as the report issued by the DEAC. Based on the 
information in these reports, we documented the concerns raised and the 
agencies' responses. We provided Commerce with a matrix summarizing 
the concerns raised and the agency's responses and obtained its views. We 
met with officials of the agencies responsible for monitoring licensing 
conditions and enforcement deemed export rules and regulations — 
principally Commerce, but also ICE and FBI. We also met with USCIS 
officials to discuss a proposed change to their Form 1-129 that would 
require employers to acknowledge deemed export licensing requirements. 
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We conducted fieldwork in Washington, D.C., as well as Boston, Los 
Angeles, and San Francisco. We selected these cities for fieldwork because 
all three have major clusters of biotechnology firms. 

We conducted this performance audit from July 2009 to February 2011 in 
accordance with generally accepted auditing standards. These standards 
require that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and conclusions 
based on our audit objectives. We believe that the evidence obtained 
provides a reasonable basis for our findings and conclusions based on our 
audit objectives. 
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Appendix II: Comparison of Numbers of Foreign 
Nationals from 13 Countries of Concern to Foreign 
Nationals from the Same Countries Covered by Deemed 
Export Licenses, Fiscal Years 2004 to 2009 

During fiscal years 2004 to 2009, a total of approximately 1.05 million 
foreign nationals from 13 countries identified by Commerce and other 
sources as countries of proliferation or other concerns were approved to 
work in the United States in specialty occupations that included 
computers, electronics, engineering, and biotechnology. Of the 
approximately 1.05 million, about 94 percent were foreign nationals from 
four countries. By comparison, foreign nationals from the same four 
countries accounted for 98 percent of the foreign nationals from the 
countries of concern covered by deemed export licenses during this 
period. Table 1 compares the number of foreign nationals approved to 
receive H-1B specialty occupation visas during fiscal years 2004 through 
2009 from the 13 countries of concern we selected to the number of 
foreign nationals from the same countries covered by deemed export 
licenses. Appendix I provides an explanation of how we selected these 
countries. 



Table 1 : Comparison of Numbers of Foreign Nationals from 13 Countries of 
Concern with Specialty Occupation Visas in Four Occupational Fields to Numbers 
of Foreign Nationals from the Same Countries Covered by Deemed Export 
Licenses, Fiscal Years 2004 to 2009 



Country 


Number of foreign nationals 


Number of foreign nationals covered 
by deemed export licenses 


A 


148,998 


2,184 


B 


818,468 


444 


C 


14,300 


314 


D 


5,772 


188 


E 


25,014 


14 


F 


22,755 


14 


G 


9,609 


9 


H 


2,453 


6 


I 


188 


2 


J 


49 


2 


K 


813 


1 


L 


249 





M 


22 





Total 


1,048,690 


3,178 



Source: GAO analysis of USCIS and Commerce data. 
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Appendix III: Summary of Outreach Activities 
of Commerce and ICE 



Commerce provides educational information and outreach about deemed 
export rules and regulations to companies, universities, and agencies in 
three ways. Commerce's Export Administration provides educational 
outreach primarily through export control seminars and conferences, 
some of which were general in nature and some of which exclusively 
focus on deemed exports. Commerce-sponsored general export control 
seminars and conferences have a module that addresses deemed exports. 
Commerce has also made increasing use of its Internet Web site, which 
features training modules and Webinars, some of which focus on deemed 
exports. Commerce's Export Administration also participates in seminars 
and conferences sponsored by other private and public sector 
organizations. In addition, Commerce's Office of Export Enforcement 
provides investigative-related outreach through meetings with associations 
and companies. As part of this outreach, in fiscal year 2005 Commerce's 
Office of Export Enforcement began its Project Guardian program to focus 
on outreach to companies and universities conducting research or 
manufacturing specific goods and technologies that illicit proliferation 
networks seek to acquire. Commerce Office of Export Enforcement 
officials told us that each of Commerce's nine export enforcement field 
offices could develop outreach plans for their areas of jurisdiction; 
however, we found that none of the three Commerce field offices in the 
cities that we visited — Boston, Los Angeles, and San Francisco — had 
developed such plans. All three cities are important in the development of 
cutting edge commercial technology — for instance, Boston and San 
Francisco have major concentrations of biotechnology companies. 

ICE and FBI also provide investigative-related outreach to associations, 
companies, and universities through association-sponsored seminars and 
meetings with university and company officials. 

Table 2 summarizes the two agencies' export control outreach efforts. 
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Appendix III: Summary of Outreach Activities 
of Commerce and ICE 



Table 2: Summary of Outreach Efforts by Commerce and ICE, Fiscal Years 2004-2009 



Agency 


Type of outreach 


Number of general export control 
outreaches 


Outreaches specific to deemed 
exports 


Commerce Export Administration 


Educational 


About 300 Commerce-sponsored 
conferences and seminars reaching 
about 25,000 people 

Commerce also participated in 
about 200 conferences and 
seminars sponsored by other 
organizations reaching about 
12,000 people 


About 600, including in-person 
presentations, e-mails, and phone 
conversations 


Commerce Office of Export 
Enforcement 


Investigative 


About 3,500 


About 50 


ICE 


Investigative 


About 9,500 


None. However, according to ICE 
officials, the agency incorporates 
materials on deemed exports as 
part of its outreach efforts 



Source: GAO analysis of Commerce and ICE data. 

Note: The FBI also provided outreach data; however, because the data provided were classified, we 
did not include them in this report. 
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Appendix IV: Draft of DHS's Changes to the 
Form 1-129 "Petition for Nonimmigrant 
Worker" 



In fiscal year 2002, we recommended that Commerce use all existing U.S. 
immigration data to identify foreign nationals who could be subject to 
deemed export licensing requirements. Commerce agreed with the 
recommendation and officials told us that they have been working with 
USCIS to make such data easier to analyze. 1 As a result of this 
collaboration, USCIS issued notices in the Federal Register in February 
and June 2010 requesting comments about a proposed change to the Form 
1-129 employers must complete to enable foreign nationals to apply for 
new employment, extend their status, or change a foreign national's 
immigration status to H-1B specialty employment or other status. This 
change would require employers to acknowledge if the position for which 
they want to hire a foreign national could require a deemed export license. 
The revised form contains two parts: One provides instructions on how to 
fill out the form, and the other contains the form itself. Figure 4 contains 
the revised form, which according to USCIS, was approved by the Office 
of Management and Budget in October 20 10. 2 



^AO, Export Controls: Department of Commerce Controls over Transfers of Technology 
to Foreign Nationals Need Improvement, GAO-02-972 (Washington, D.C.: Sept. 6, 2002). 

2 Under the Paperwork Reduction Act of 1980 (Pub. L. No. 96-511, 94 Stat 2812), the Office 
of Management and Budget is required to review all proposed changes in government 
forms that could result in an added collection burden on the public. 
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Appendix IV: Draft of DHS's Changes to the 
Form 1-129 "Petition for Nonimmigrant 
Worker" 



Figure 4: Revisions to USCIS Form 1-129 That Address Deemed Export Concerns 



Certification Pertaining to the Release of Controlled Technology or 
Technical Data to Foreign Persons in the United States 

U.S. Export Controls on Release of Controlled Technology or 
Technical Data to Foreign Persons. The Export Administration 
Regulations (EAR) (15 CFR Parts 770-774) and the International Traffic in 
Arms Regulations (ITAR) (22 CFR Parts 120-130) require U.S. persons to 
seek and receive authorization from the U.S. Government before releasing to 
foreign persons in the United States controlled technology or technical data. 
Under both the EAR and the ITAR, release of controlled technology or technical 
data to foreign persons in the United States-even by an employer-is deemed to 
be an export to that person's country or countries of nationality. One 
implication of this rule is that a U.S. company must seek and receive a license 
from the U.S. Government before it releases controlled technology or technical 
data to its nonimmigrant workers employed as H-IB, L-I or O-IA beneficiaries. 



Application 

I I 



Part 6. Certification Regarding the Release of Controlled Technology or Technical Data to Foreign 
Persons in the United States 



(For H-IB, H-1B1 Chile/Singapore, L-l, and O-IA petitions only. This section of the form is not required for all other classifications. 
See Page 3 of the Instructions before completing this section.) 

Check Box 1 or Box 2 as appropriate: 

With respect to the technology or technical data the petitioner will release or otherwise provide access to the beneficiary, 
the petitioner certifies that it has reviewed the Export Administration Regulations (EAR) and the International Traffic in Arms 
Regulations (ITAR) and has determined that: 

^| 1. A license is not required from either U.S. Department of Commerce or the U.S. Department of State to release such 
technology or technical data to the foreign person; or 

02. A license is required from the U.S. Department of Commerce and/or the U.S. Department of State to release such 

technology or technical data to the beneficiary and the petitioner will prevent access to the controlled technology or 
technical data by the beneficiary until and unless the petitioner has received the required license or other authorization 
to release it to the beneficiary. 



Source: U.S. Citizenship and Immigration Service. 



Requirement to Certify Compliance with U.S. Export 
Control Regulations. The U.S. Government requires each 
company or other entity to certify that it has reviewed the 
EAR and ITAR and determined whether it will require a 
U. S. Government export license to release controlled 
technology or technical data to the beneficiary. If an export 
license is required, then the company or other entity must 
further certify that it will not release or otherwise provide 
access to controlled technology or technical data to the 
beneficiary until it has received from the U.S. Government 
the required authorization to do so. The petitioner must 
indicate whether or not a license is required on Page 5, 
Part 6 of Form 1-129. 
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Appendix V: Comments from the Department 
of Commerce 




UNITED STATES DEPARTMENT OF COMMERCE 
Under Secretary for Industry and Security 

Washington, D.C. 20230 

November 9, 2010 



Mr. Joseph Christoff 

Director, International Affairs and Trade 

Government Accountability Office 

441 G Street, NW 

Washington, DC 20548 

Dear Mr. Christoff, 

Thank you for the opportunity to comment on the draft Government Accountability 
Office (GAO) report entitled "Export Controls: Improvements Needed to Prevent Unauthorized 
Technology Transfers to Foreign Nationals in the United States (1 1-70)." 

The Department of Commerce concurs with the first recommendation and will review the 
prior recommendations in the ongoing Export Control Reform process. The Department also has 
attached technical comments on the report. 

If you need further assistance, please contact Mark Crace of the Office of Administration. 
Mr. Crace may be reached a t (202) 482-8093 or via e-mail at mcrace@bis.doc.gov . 



Sincerely, 




Eric L. Hirschhom 
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Appendix VI: Comments from the Federal 
Bureau of Investigation 



US. Department of Justice 



Federal Bureau of investigation 



Washington. D. C. 20555-0091 
November 23.2010 



Mr. Joseph ChrisEoff 

Director. International Affairs and TFade, 

Government Accountability Office 

441GSL.NW 

Washington, DC 2054S 

Dear Mr. Christoff. 

Thank you for the opportunity to review the draft Government Accountability Office {GAG) report entitled, Export 
Controls, Improvements Needed to Prevent Unauthorized Technology Transfers to Foreign Nationals in the United 
States (hereinafter, "Report"). In an effort to ensure the Federal Bureau of Investigation's (FBI) involvement in the 
area of deemed ex pons is accurate iy represented in the Report, i have attached our previously submitted factual 
accuracy comments for your direct consideration and review. 

In addition, die FBI has previously identified to the GAO many areas of the Report which contain classified 
information. As discussed with your auditing team, the identification of vulnerabilities or specific areas of 
investigative focus must be redacted due to national security matters. 

As noted in our earlier comments, the FBi enforces deemed export licence regulations by conducting criminal 
invesiigations as well as taking the lead in investigations involving counterintelligence and counterterrorism. The 
FBI has conducted outreach to small-to-mid-size companies in the biotechnology industry to foster awareness 
deemed exports pose. Specifically, the FBI has engaged biotechnology companies through several venues, 
including strategic task forces, counterintelligence working groups, conferences, and other initiatives. The FBI has 
also coordinated this outreach with the United States Intelligence Community and federal law enforcement agencies, 
including Immigration and Customs Enforcement (ICE) and Department of Commerce (DOC). Office of Export 
Enforcement on these outreach programs. Through participation at the National Export Enforcement Coordination 
Network (NEECN) and other arenas, the DOC. ICE. and the FBI have worked to resolve coordination of export 
enforcement activities. 

As duly noted in your Report, in order to ensure that deemed exports receive additional attention, law enforcement 
agencies need to receive more resources, particularly for the areas of outreach and investigations. 

Thank you for your efforts, and should you have any additional questions please do not hesitate to contact me or my 
office. 




Deputy Assistant Director, 
Counterintelligence Division 

Attachment 

UNCLASSIFIED when separated from CLASSIFIED attachment 
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GAO's Mission 



Obtaining Copies of 
GAO Reports and 
Testimony 



The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 
is through GAO's Web site (www.gao.gov). Each weekday afternoon, GAO 
posts on its Web site newly released reports, testimony, and 
correspondence. To have GAO e-mail you a list of newly posted products, 
go to www.gao.gov and select "E-mail Updates." 
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